ls11 show101

SHOW101 Using IBM Lotus Domino 8.5.x Policies to Manage Your Clients

Darren Duke | Technical Lead |Simplified Technology Solutions, Inc. (STS)

Agenda

Who is this dude and what will I learn?

Section 1 A complete example, start to finish

Section 2 Advanced policy and setting options

Section 3 Other Lotus Notes policy settings

Section 4 When it all goes wrong

Session wrap up

Q & A

Who is this dude?

Darren DukeTechnical lead and founder of Simplified Technology Solutions, Inc. (STS)

From Atlanta, GA (despite the accent originally from Hartlepool in the UK)

Been involved with IBM Lotus Notes and Domino since R3

All I do is Lotus portfolio related

Podcasts, blogs, websites, etchttp://blog.darrenduke.net

http://www.TipsInTwo.com

http://www.simplified-tech.com

http://www.planetlotus.org

http://www.ThisWeekInLotus.com

Experience is then name one gives to their mistakes Oscar Wilde

Where did the idea for this session come from?

During audits, heath checks, upgrades and training, it became apparent that some Domino customers....Under-utilize policies

Don't recognize the benefits of policies

Haven't looked at policies since R6.x

Find policies confusing

Or even worse....Have never used policies. Shock. Horror. *cue scary music!*

So, this session was created to help you, the Super.Human.Admin toBetter manage you Domino environment

Enhance your end users' Lotus Notes experience

Make your life easier!

Spend more time on the beach/playing Call of Duty/singing in Kimonos/learning Websphere/getting more golden eggs on Angry Birds

What will I learn? There's a policy for that!

Just like the iPhone....Need to find a clean public toilet? There's an app for that! (no, seriously, there is!)

Need to get lost in downtown Chattanooga looking for a restaurant? There's an app for that!

The same is true for Notes....Need to set password complexity rules? There's a policy for that!

Need to add icons to a users bookmark bar? There's a policy for that!

Need to enforce spell check and blank subject lines? There's a policy for that!

With policiesYou can make your Domino admin life a whole lot easier

Change settings at a moment's notice

Look like a rock star and get a pay raise*

Accomplish tasks faster and more efficiently

Increase your skill set and show the AD folks that, yes, we have them too

*sorry, we can only guarantee that you will deserve a raise, not that you will get one.

Two sessions in one!

Well, not quite, but close

First half of this session will cover an example policy, and the common settings you may wish to apply, from start to finish

Second half will cover advanced policy topics, such an enforcement, inheritance and dynamic policies

RGE = Resume Generating Event

Agenda






Session wrap up

Q & A

Section 1 An Example Policy

First, we will create a registration policy that will automatically populate all the common settings an administrator would enter when registering new users

Next, we will create a series of policy settings documents to make the end user experience with Lotus Notes much better

Then, we will create an organization policy and assign the settings. This policy will be pushed out to all users within the organization

Finally, we will create an additional policy for laptop users so thatInheritance will be used to reduce the number of setting we have to manage

Their passwords are more complex

In the beginning....

When a Domino server is first installed...All settings are set to their default configuration

No policies exist

You maybe overwhelmed with the possible permutations and options

Some default settings are just plain silly

So, we will take the blank canvas that is the default/initial state andCreate a registration policy to allow a new user to be added by populating only 3 items of information

Create an organizational policy for a series of commonly enabled settingsTo make your life easier

To make the end users' experience much, much better

Example Policy

Registration Settings

Desktop Settings

Mail Settings

Security Settings

Additional Policy for Laptop Users

Policy Settings - Registration

Allows you to set common options used while registering a new user within Domino

Will significantly reduce the time you spend registering new users

Standardize common options across new usersInternet domain

Email address format (darren_duke, darren.duke, dduke)

Quotas and warnings

Registration Example

Create a policy to register a new user and create a mail file in a clustered environment

This will allow us to register a new user by entering just 3 pieces of informationFirst name

Last name

Password

Other, common to all new users settings will be automatically populated by the policyRegistration server

Password quality

Internet address

Mail server, file and address attributes

Certifier and user ID file information

Registration creation

Create a new registration settings documentOpen the Domino Directory

Open the Configuration, Policies, Settings view from the navigator

In the Add Settings action, select Registration

Registration creation - Basics

Populate some meaningful name and description

Choose a registration server

Set the internet password

Registration creation Mail 1

Populate mail systemLotus Notes, right?

Choose the (home) mail server

Set the mail template for the new mail file

Decide how the mail file should be created

Enter the organization's internet domain to be used in the SMTP email address

Create an internet address formatdarren.duke

dduke

darren_duke

Registration creation Mail 2

We have a clustered environment, so we will select to create a replica of the mail file on a cluster mate

Select the ACL level for the new mail file ownerSet this to Editor

Enter a manager if you need one

We choose to create a FTI

A quota of 2GB is set

A warning of 2,000MB is set

Registration creation ID/Certifier

Check the box to create a Notes ID

We're going to up the key and width to 2048 bits and 128 bits respectively

Set the expire date to 48 months outThis will be 48 months from when you actually register a new user, not today

Notice no ID storage is selectedWe'll use ID Vault for this8.5 server

8.5 client

Registration creation Miscellaneous

Add any groups than will have the new user added

Setting is complete so click Save and Close

Create the Registration policy and add the setting

Now we'll create a new policy and assign this new setting to it

In the Domino Directory, navigate to Configuration/Policies and click the Add Policy action

Registration policy add the settings

Add a policy name, make it meaningful

Type is explicit

Add an optional category

Select our new registration settings document from the drop down in the Registration Setting Type field

Save and close

Registration policy time to test!

Remember, the goal is to only enter 3 fields in order to get a new user registered

Open up Domino Administrator and register a new user as you normally would

Enter the certifier ID and password


On the basics tab, select the new explicit policy we just created from the drop down list


Fill in the following:First name

Last name

Password

Yes, that is itAll the settings from the LS 10 New User on Hosted are applied

To check this.....

Registration policy success!!!

Check the Advanced check boxCheck some other random tabs

In this case MailAll the settings are populated!

And then bask in the time you saved

Remember to keep your policy updatedWhen the mail template is updated

If you need extra mail file replicas

Example Policy


Desktop Settings

Mail Settings

Security Settings


Desktop settings for end users

Some really useful settings are not enabled by default

We will add this new setting to an existing organizational policy to apply these useful settings

Again, we need a desktop settings document and a policy document

Desktop settings creation

Create a new registration settings documentOpen the Domino Directory


In the Add Settings action, select Desktop

Desktop - Basics

Select Enable Synchronize Contacts on the replicator tabNew in 8.5.1 (thanks, Mary Beth!)

Optional select Do not auto add names to Recent ContactsNew in 8.5.2

Can cause some confusion for users

Desktop Basics Recent Contacts

A new feature in 8.0 and being improved upon with each release

Adds recipients and senders to a users local address book

There are more options in the Notes client than are in the policy and appear to have no published Notes.ini setting

You may want to exclude addressesNotes.ini DPABRemoveRule

DPABRemoveRule=foobar,bar

Desktop Mail 1

Local mail fileManaged replicas are new in 8.5.2 and offer full control over local mail replicas -covered a little later

Desktop Mail 2

Client SettingsUsed to determine what a managed replica will pull down

Silently fail over to another cluster server (now with Collab Express too)

Also auto upgrade local NSF files to latest ODSUseful for DAOS with local mail.box

Desktop Preferences\Basics

Enable autosave

Autosave every N

Lock ID

Desktop Preferences\Misc 1

Enable right-double click

Process print in background

Retain view column sorting

Enable MS Office SendTo

Desktop Preferences\Misc 2

Enable Compress images pasted into documents

Enable Drag and Drop save as EML (new in 8.5.2)

Desktop Preferences\Mail

Check for new mail

Mail checking interval

Play a sound

Refresh inbox

Show an icon

Desktop Preferences\Network Ports

Set the ports you use to compressNote, you also have to enable port compression on the server too

Costs CPU (3-5%) but can reduce bandwidth by up to 35%

Desktop Diagnostic

Having a Notes client send in NSD reports can be very helpful for troubleshooting client crashes

(Create and) Select the NSD mail in database

Desktop Assign it to an organization policy

Now we'll create a new policy and assign this new setting to it

In the Domino Directory navigate to Configuration/Policies and click the Add Policy action


Add a policy name - make it meaningful

Type is Organizational

Add an optional category to make it easy to understand

Select our new desktop settings document from the drop down in the Desktop Setting Type field

Save and close


Notes about what we just didWe can reuse the same organization policy to push out other settings, i.e Mail, Archiving, etc

When a user authenticates with their home server, then new settings will be pushed down to the client and applied if necessary

We set most settings to Set Initial Value so that end users can change them if they so wish

Managed Replicas Overview and Sidebar

Requires 8.5.2+ server AND client

Used to fully manage local mail replicas

Allow asynchronous mail send from client

Allows the Notes client to auto replicate is new mail has arrived

Allows auto ODS client upgrades (good for DAOS)

Can control size of local NSF if needed

Can significantly improve the Notes mail user experienceRemember to Full Text Index via the Desktop Policy/Replication tab

Excellent video via IdoNoteshttp://www.youtube.com/watch?v=-TrJHtJ9-MU&hd=1

Next Managed Replicas side bar.....

Managed Replicas Mail Settings

Local mail file:Create local replica (the old way)

Create managed replica (if one already exists do nothing)

Create managed replica or convert local replica to managed replica

Delete local or managed replica

A local managed replica is now considered a best practiceLocal replicas were always best practice, just not easy to maintain

Managed Replicas Mail Settings 2

Mail file locationOn Server

Local

I use Local

Use Local mail.box to send messagesAllows asynchronous send when using server replica

No more waiting for that large attachment to send

Put 1 so outbound mail is sent immediately

Fill in prior to selecting Local in the above field

Managed Replicas Managed Replica Settings 1

Keep full documents for the most recent x daysNewly created managed replicas only

Does not affect existing local (managed or not) replicas

Selective replicaMakes the managed replica a partial replica

If you do this, train your users on partial replication

If selected remove documents option is also shown

Managed Replicas Managed Replica Settings 2

Amount of free space required before cache is createdSize in MB that must be free on local workstation before replica is created

Truncation amountsOnly applies to documents older than the Keep full documents for the most recent x setting

Will pull down specified amounts in KB for each setting

Managed Replicas Client Settings 1

Auto-retrieve document settingOnly applies to truncated documents

The client pulls down the data from the server as the message is opened

Enable document without attachmentGet body only, truncate attachments

Fastest setting

Enabled document with attachmentGet body and attachments


Enable server to poll for new mail and trigger replicationAllows local replica to replicate automatically as soon as new mail is triggered on the server

Replicates immediately (no waiting on scheduled replication)

Enable silent failover when server goes downIf you are on a clustered mail server no more pesky popup boxes asking the user do they want to switch servers

There is a notes.ini setting for releases 8.0+ for this featureHidePromptFailoverInc=1


Enable upgrade of all local NSFs to latest ODSAutomates the conversion of all local NSF files, including mail and mail.box

Helps with DAOS and sending known attachments to server on reply and forward

The truth about settings you need more than one

Desktop is really just one of the trilogy of the settings you want to implement as standard

The others are Mail and Security

We will now create a mail settings document and assign it to our organizational policy

Example Policy


Desktop Settings

Mail Settings

Security Settings


Mail settings for end users

Some really useful settings are not enabled by default


Again, we need a new settings document and an existing policy document

Mail Settings Document

Create a new mail settings documentOpen the Domino Directory


In the Add Settings action, select Mail

Mail Settings - Basics

Enter a meaningful name and description

Mail Settings - Mail\Basics 1

Disable ownership changing

Enable spell check

Enable blank subject warning

Enable auto closing of original email when reply or forward

Mail Settings - Mail\Basics 2

Enable inbox maintenance

Enter a number of days for inbox removal

Enable non-removal of unread emails

Mail Settings - Mail\Attention Indicators

Enable recipient icons

Mail Settings - Mail\Message Recall

Check with your legal counsel or upper management before enabling thisIt can cause issues with retention policies

I didn't stay at a Holiday Inn Express last night, so don't ask me

Mail Settings - Mail\Message Disclaimers

If your organization requires this, this is where to set it

You also need to set the server configuration document, too!

Mail Settings - Calendar\Display

Enable display new (unprocessed) notices

Mail Settings - Calendar\Scheduling

Change the availability to hours that suit your organization's work day

Enable checking for conflicts

Mail Settings - Calendar\Alarms

My pet peeve, and one of the silliest settings is that alarms are disabled by default!

Enable all alarms and adjust the advance time as necessary

Mail Settings - iNotes\Configuration

8.5 and 8.5.1 added some nice settings to iNotes

Making iNotes as similar as possible to Notes clients makes end users happy

Enable mail threads

Enable refresh inbox

Enable unread count

Enable scroll hints

Mail Settings - Client Detection

Another great setting used for calendar interoperability between Notes/Domino and other messaging platforms, specifically for repeating options in meeting invites

Allows administrators to map internet domains to specific messaging platforms like MS Exchange, Zimbra and Mozillaor

Allows the end user to select manually when sending an invite

This can also affect Lotus Notes invitees

You will need to train your end users about this feature if you choose manual

Mail Assign it to an organization policy

Notes about what we just didWe can reuse the same organization policy we created earlier to push out with other settings, i.e Desktop, Archiving, etc

We set most settings to Set Initial Value so that end users can change them if they so wish

Next up is the last of our common client settings, Security

Example Policy


Desktop Settings

Mail Settings

Security Settings


Security Settings

Ostensibly this contains settings to make the administrator's life easier

Or

To make the Domino environment more secure


Again, we need a new settings document and an existing policy document

Security Settings Document

Create a new security settings documentOpen the Domino Directory


In the Add Settings action, select Security

Security Settings - Basic

Enter a meaningful name and description

Security Settings Password Mgmt\Basics

Lotus Notes has the capability to allow for some very sophisticated password options

To allow for this option, enable Custom Password Policy and a new tab appears

Enable Update Internet Password

Enable Password Expiration, the required change interval and a grace period

Security Settings Password Mgmt\Custom Password Policy

Yes, you can force users to change their password the first time they use a Lotus Notes clientNo more lotusnotes, p@ssword, etc

Fill in the fields that are required by your organizations' complexity requirements

Security Settings Password Mgmt\Notes Shared Login

Replacement for Single Sign-On option that is now controlled via a policy

Enable if you wish to have Notes automatically login with the end users Windows password

Be careful using with ID Lock Out - the password prompt is hidden!

Security Settings ID Vault

One of the best features in 8.5

Not usually set manually, but via the ID Vault wizard

See LS10 SHOW101 for more details on ID Vault

Shown here for reference only

Security Assign it to an organization policy

Notes about what we just didWe can reuse the same organization policy we created earlier to push out with other settings, i.e Mail, Archiving, etc

Most of the security settings do not have a drop down option. More on that later.

We are now done. Some useful settings are now enabled and will be pushed down to the Lotus Notes client.

Example Policy


Desktop Settings

Mail Settings

Security Settings


Additional policy for laptop users

To create a new policy we canStart afresh with all new policy and settings documents

Start afresh with all new policy document, reuse similar settings, create new settings for changesBoth of these are time consuming and error prone

OR

We can use policy inheritance to inherit values from a parent policy and change only the items we wish in the child Fast, and we are assured whenever a parent changes, the child will too

Create a child policy, set for inheritance

Add new settings documents to change as required

Additional policy for laptop users

RecapAll of the settings from the LS10 Example policy (created earlier) will be inherited to these users

Their passwords are more complex

Our new users will be in a group called Laptop UsersThis will be assigned the new explicit dynamic policy we are about to create

Edit an existing policy

Create a new child policy from an existing policy documentEdit an existing policy in the Domino Directory, Configuration, Policies navigator

The one we will edit will be the parent for our new laptop policy


Use the Create Child button to create new policy document


Enter a policy name for the childNotice the parent policy is indicated here

More complex passwords

We will add a new Security Settings document to this policyClick the New button in the policy document

Add a name and description to the new security settings document

To add inheritance to all fields manually is tedious, so select the Inheritance action button and select Enable for all fields


Notice how all options now have Inherit for parent policy checkedThese settings will now be inherited from the parent

The parent policy, via its own settings, has a password length of 8. For this policy we will set it to 12

Our new change will be entered under the Password Mgmt/Custom Password Policy tab Uncheck Inherit, so that this policy will specify its own setting

Change the password length value to 12

So any children of this policy cannot change from 12, we check enforce


Save and close and assign the setting to our child policy

Once the child policy document is saved, we now have child policy that can be used as a dynamic policy

Assigning the dynamic policy

Assuming we already have a group called Laptop Users, we will now assign that via a dynamic policy

Open the Policy Assignment tab on your child policy document and use the drop down pick list to select the group

Forcing precedence

So that this new policy will always be applied, this new policy will have the highest precedence

Testing child polices and inheritance

Users in the Laptop Users group will now be assigned the new policy

Using the Policy Synopsis Tool (covered in detail later), we can see the new settings as assigned to a member for the above groupNote the PwdLenMin =12 came from Laptop Users

While

PwdLowMin=1 came from LS10 Example

This is due to the inheritance we just created

Editing the policy or setting

Any of the policies or settings we just created can be edited or removed just like any other Lotus Notes document

Section 1 - Summary

We just created a set of policy settings documents that will allow for a much better Lotus Notes experience for both end users and administrators

We can have a single policy document and assign settings to it

We set most settings to Set default value so an end user can still change the setting

Agenda






Session wrap up

Q & A


Policy vs Setting

The Policy Document

The Settings Document

Inherit and enforce

What is the effective policy

Dynamic Policies

Policy vs Setting

Policy documentComprised of one or more settings documents

Is used to assign a policy to a user, group, OU or entire organization

Is very simple

Can change from version to version and release to release

Setting documentProvides up to10 different, (somewhat) logical groupings of Lotus Notes or iNotes settings. This is in 8.5.1, earlier versions may have less groupings

Is assigned to a policy document

Users assigned these settings (via the policy document) will get the values as set

Is rarely simple

Can control almost every aspect of a Lotus Notes client and the Notes user

Usually changes from version to version and release to release


Policy vs Setting

The Policy Document


Inherit and enforce


Dynamic Policies

Policy document overview Creation

From the Domino Directory left navigatorPolicies

Add Policy

Policy document overview Basics

Policy nameEither a meaningful name if Explicit

Or a root Org */

Or an OU name */OU/O

Policy TypeExplicit set via person doc or dynamic policy (new in 8.5.x)

Organizational set to all users of the Org or OU

DescriptionFree text

CategoryFree text

Policy document overview setting type

Assign or create a settingAvailable options are controlled by pubnames.ntf version

Different releases, different optionsAnd even nomenclature can change

Activities in 8.0.2, Connections in 8.5.1

More setting types in 8.5.x

Domino 7 had 5 setting types

New tabs in 8.5Policy Assignment

Policy Precedence

Covered later in detail

8.0.2

8.5.1

Ways to apply a policy

There are 3 ways to apply a policy(1) With an organizational policy documentAll users within this O or OU will automatically be assigned the policy

(2) Explicitly with an explicit policy documentAn individual user is assigned this via the person document under the administration tab, policy management section

(3) Via dynamic policies (new in 8.5)A group can be assigned a policy and when a user is added to the group, they are assigned that policy

Policy Security

If it appears you can't create or edit policies, check the ACLYou need [PolicyCreator] to add rules

You need [PolicyModifier] to edit rules

You need [PolicyReader] to read rules

Policy documents are encrypted...With the Owners ID

Guess what happens when the owner leaves...They stop working

They will need to be re-saved

So always populate the Administrators field


Policy vs Setting

The Policy Document


Inherit and enforce


Dynamic Policies

Demystify How to apply this setting

It is a feature that allows an admin toOptionally set default values and let the user change the valuesNew mail check time

Enabled calendar alarms

Optionally set default values and prevent the user from making changesEnforce security settings

Implement company procedures

There are four possible options when applying settingsDon't set value

Set initial value

Set whenever modified

Set value and prevent changes

Check boxes and drop downs indicate setting exposureCheckboxes - no Notes client setting is available for the user to changeUse Custom Password Policy (Security Settings)

Drop downs - the setting is exposed to the Notes client and the user may changeSpell-check messages before sending (Mail Settings)

Don't set value drop down

No value is specified

Uses the initial client install setting

End user can change the value on their client

The setting is usually off or disabled

Off is the standard setting for almost all policies, including some ones that should really be onCalendar alarms. Because you remember every meeting, right?

Spell check before send.

Enable Autosave. Never seen an NSD before!

Set initial value

The setting specifies the new default valueAnd is sent to the end user a single time

End user can change the value on their clientThen their custom value is used going forward

Use this to apply helpful end user settingsSee previous slide :)

We'll cover more of these later

Remember, you really don't want your end users randomly playing with preferences

Set value whenever modified

The newest option and the least useful

End user can change the value on their client

However, the end users' value is overwritten by the policyThis refresh happens when the policy is applied, approx every 12 hours

If you have end users you hate, this is for youYou can drive them insane

I can't really think of a use for this

Set value and prevent changes

The value you specify is used in the client

End user cannot change the value on their clientIt will most likely be grayed out and disabled on the client

Use this to apply security settings and to protect the end user from themselvesLock ID after N minutes of inactivity

Push ECL settings to Notes clients

Other nuggets

Existing inheritance is is also inherited

Existing enforcement is also enforced

Be careful with Set value whenever modifiedYou will overwrite any end users' custom settings

Yes, this is always the CEO, CIO or their assistants


Policy vs Setting

The Policy Document


Inherit and enforce


Dynamic Policies

Inherit and enforce....eh?

Inheritance is powerful, but confusingAllows an administrator to provide settings at a high level, but provides for control at a granular level

Prevents the need to keep all settings up to date and in unison

Hugely simplifies audit requirements

Any policy document can be used as a parent (or template) to create child settings documentsAny enforced settings are passed to any child policies and the child setting is ignored

Any inherited settings are pulled from the parent policy but can be changed, if required

This allows general settings to be controlled at the parent, and if required, changed at the child

An example of inheritanceAll users need the same internet address format and domain

All users in a given OU will be local replica users

Set different password length or complexity rules at the OU level

Example for password length follows

Inherit example 1

The following examples are from the Notes Admin helpGreat programmers write good code. Great programmers steal good code

Each OU level has set its own password length with no inheritance or enforcementJohn Doe/Acme will be assigned a PQ of 8

Jane Doe/Sales/Acme will be assigned a PQ of 7

Joe User/NE/Sales/Acme will be assigned a PQ of 6

Inherit example 2 - inherit

*/NE/Sales/Acme is set to inherit from */Sales/Acme

This allows all */Sales/Acme users to receive the same PQ length regardless of their location in the OU hierarchyJohn Doe/Acme will be assigned a PQ of 8



Inherit example 3 - enforce

Enforcement over-rides any child setting

*/Acme is set to enforce in all child policies

This allows all */Acme users to receive the same PQ length regardless of their location

It also prevents any lower policy from over-riding itAll user will be assigned a PQ of 8




Policy vs Setting

The Policy Document


Inherit and enforce


Dynamic Policies

What is my effective policy?

With so many different ways of assigning a policy it can be useful to understand how they are evaluated and assigned Organization level polices are applied first

Explicit policies with dynamic policies are applied next

Finally, explicit policies without dynamic policies are applied

This can still be difficult to resolve the exact policy a user is assigned and how they are assigned itPolicy Synopsis is your friend

Available from the Person view in Domino Administrator

Using Policy Synopsis

Select a user from the person view in Domino Administrator

Expand Tools and click Policy Synopsis

Select the desired optionsHold CTRL to select multiple Detailed reports

Select a synopsis database location

Hit OK

The synopsis DB will open

Default DB is local/polcysyn.nsf

Reading a Policy Synopsis

Open the Policy Synopsis Database, and the synopsis document

Each policy setting field is listed with its value

It helps if you know the field names ;)


Policy vs Setting

The Policy Document


Inherit and enforce


Dynamic Policies

Dynamic Policies

Is really just a new tab in the policy document and is an explicit policy

Allows policies to be assigned to users or groups

Allows the precedence of the policies to be assigned

Can radically simplify the need for setting explicit policies to individual end users

A dynamic policy is created by populating the Policy Assignment tab in the policy documentYou need either [PolicyCreator] or [PolicyModifier]

Understand the policy hierarchy and precedence

Dynamic Policies precedence

Allows effective policy to be calculated should there be a setting conflictIf the same user or group has more than one dynamic policy assignment, precedence resolves any potential conflicts

Dynamic policies have a higher or lower relative precedence to other dynamic policies

Precedence level 1 is highest and policies can be increased or decreased via actions in the Dynamic Policies view

Dynamic Policies be careful

Be sure you know who is getting what setting and from where that setting is being appliedAs with any policy manager, AD, LDAP, etc multiple settings from multiple locations can lead to spaghetti soup

Figuring out the issues can be time consuming and difficult

Make sure to use Policy Synopsis to help figure it out

Test, test and testProduction is not a test environment

What does this Limey know, I know what I'm doing. Well maybe.......Yes, it is sure fire way to get instant feedback. Watch that phone ring!

But it can be an RGE (resume generating event) for you

So, don't do it!

Policy Settings Documents Note to Self

RTFM for every releasePolicy settings are added often

Settings documents are the way of the futureMake sure you don't miss a setting option because you did not RTFM

In case you're not getting this...

RTFM=F1

Section 2 Advance policy and setting options - Summary

In this section we covered various enhancement to the policy and setting framework

We have seen how enforcement, inheritance and dynamic policies can make administration of policies simpler

We have learned to use the Policy Synopsis Tool to evalue an effective policy for a give end user

Agenda






Session wrap up

Q & A

Policy Settings Types

There are currently 7 settings types in 8.5.1 and 8.5.2Registration*

Setup

Archiving

Desktop*

Mail*

Roaming

Security*

There are an additional 3 settings for Lotus add-onsConnections

Lotus Traveler

Symphony

* covered in Section 1

Other Lotus Notes Policy Settings

Archive Settings

Setup Settings

Roaming Settings

Summary

Policy Settings Archiving

One of the most divisive options in an organizationJust like Fight Club, the first rule of archiving is never talk about archiving

I use it, I like it

It can also be used to disable local archiving, not just enable it

Archiving Document

Create a new archiving settings documentOpen the Domino Directory


In the Add Settings action, select Archiving

Archiving Document - Basics

Add a name

If you wish to prohibit archiving altogether, check the box. All other options disappear

Select where archiving will be performed, source location and destination locationUser's local workstationLess disk space used on server

Easier to full text index

Difficult to backup

ServerCosts server disk space

Easy to backup

Archiving Document - Basics

If you do server to server archive then you need to set up a special compact command

compact -a or compact -A will allow the server to server archiving to work

If your archive policy seems not to be working, try running it from the Domino console and watch for errors

Thankfully there is a warning on the settings document reminding you to do this

Some organizations have archive destinations set to another server with cheap storageFor example from an AS400 to Linux

Archiving Document Selection Criteria

Create a new criteria, add an existing criteria or remove criteria

You will need at least one criteria for archiving to work!

This is the one settings document that creates additional settings documentsArchive Criteria Settings

We'll cover this new document in a later slide

You can add multiple criteria to a single settings document

Archiving Document Logging

Logging is optionalBut enabled by default

Will log all archive activity, and doclinks to archived documents

When enabled, specify the location and naming format for the log fileDefaults to settings below

Archive Criteria Document

The extra settings documentYou will need to check the Enable this criteria to make it work!

Choose how should document be archivedTip, without = delete (potential RGE)

Choose how should documents be cleaned upreduce = leave header, include doclink

Choose which documents should be cleaned upolder than only works on >= R7 servers

Finally, if you wish change the template

Optionally, you can select only to archive from certain folders

Select a destination folder and naming formatThe actual server it will be archived to is specified on the archiving settings document, not here

Remember to add the criteria!

Archiving Document Advanced

Specifies options about the documents that are eligible for archivingOnly archive a document when all responses match criteriarecommended

Use a custom expiration field

Archiving Summary

This is a policy setting that makes sense to set explicitly to users or groups (with Dynamic Policies)

You still need to issue a compact -A or compact -a on the server to carry out any server side archiving

If you use local archives, make sure you back them upIf you lose the drive, you lose the archive

It can be very beneficial for the serverLess indexing

Keeps production mail files slim and svelte


Archive Settings

Setup Settings

Roaming Settings

Summary

Policy Settings Setup Document

Don't use this policy setting!All Setup options are now available in desktop settings documents

It is recommended you migrate to using desktop settings documents

Allows you to set common options used when Lotus Notes is started for the first time by a user

Sets options in the location document and user preferences

As this is deprecated, see the Desktop Settings slide


Archive Settings

Setup Settings

Roaming Settings

Summary

Policy Settings Roaming Document

Allows a policy to control roamingEasier to manage than manually setting on a per user basis

See LS10 SHOW103 for more details on roaming

Again, Dynamic Policies can be your friendCreate a group called Roaming Users

Add a Dynamic Policy with this setting to this group

Add or remove users from group as required


Archive Settings

Setup Settings

Roaming Settings

Summary

Other Lotus Notes Policy Settings - Summary

With other settings documents you can control a whole host of other Lotus Notes and end user related options

Setup is deprecated, use desktop settings instead

Archiving, like fiber and exercise, is good for you and your server even though no one likes it

Agenda






Session wrap up

Q & A

When it all goes wrong

When a policy will not assignCheck the user's effective policy using the Policy Synopsis Tool

Delete the policy documents in the user's local address book (names.nsf)

Deleting local policy documents

Open the local names.nsf file for the user in question

From the view menu, select Go To while holding down the Shift and Control keysShift + Control will show hidden views

Select the view ($Policies) in the dialog

Deleting local policy documents

In the ($Policies) view you will see a series of policy documents

To reset all policies on the client simply delete all of the policy documents from this view

Restart the affected Lotus Notes client and the policies will be retrieved from the server

Mail policies may take up to 12 hours, as they are controlled by AdminP

Agenda






Session wrap up

Q & A

Session wrap up

In this session we have seen howPolicies can be used to alleviate apparent end user issues with Lotus Notes

Lotus Notes can do complex password requirements

You can force Lotus Notes users to change their password the first time they use Lotus Notes

To create a series of useful settings and assign them to an organization policy and/or an explicit policy

We have also learnedWhat inheritance and enforcement are and how they affect an end user's effective policy

How to use the Policy Synopsis tool

That other Lotus Notes policy settings can have a beneficial impact on server and end user management

Other sessions you may want to attend

ID105- DAOS Deployment and Best Practices

BP101 - Adminblast 2011: Over 60 Tips in 60 Minutes!

SHOW105 Assemble 'n Go: Integrate Data and Directories with Tivoli Directory Integrator

BP103 Got Problems? Let's Do a Health Check

SHOW110 How To Build a Better Cluster

BP111 - CSI Domino : Investigating Server Crashes and Deciphering NSD's

BP116 Backup 101: The What, How and When

Agenda






Session wrap up

Q & A

Questions (and hopefully Answers)

??????

Legal Disclaimer

IBM Corporation 2011. All Rights Reserved.The information contained in this publication is provided for informational purposes only. While efforts were made to verify the completeness and accuracy of the information contained in this publication, it is provided AS IS without warranty of any kind, express or implied. In addition, this information is based on IBMs current product plans and strategy, which are subject to change by IBM without notice. IBM shall not be responsible for any damages arising out of the use of, or otherwise related to, this publication or any other materials. Nothing contained in this publication is intended to, nor shall have the effect of, creating any warranties or representations from IBM or its suppliers or licensors, or altering the terms and conditions of the applicable license agreement governing the use of IBM software.References in this presentation to IBM products, programs, or services do not imply that they will be available in all countries in which IBM operates. Product release dates and/or capabilities referenced in this presentation may change at any time at IBMs sole discretion based on market opportunities or other factors, and are not intended to be a commitment to future product or feature availability in any way. Nothing contained in these materials is intended to, nor shall have the effect of, stating or implying that any activities undertaken by you will result in any specific sales, revenue growth or other results.

Click to edit the title text format





Click to add text

2011 IBM Corporation



Click to add text


